Operationalizing Cyber Threat Intelligence with GraphRAG

When a security researcher publishes a report on a cyberattack, detection engineers are supposed to turn it into working detection rules. In practice, most automated attempts at this only extract the simplest clues from the report --- bad IP addresses, domain names, and file hashes --- and turn...

YAVIN: A Unified Architecture for Secure Edge Processing in Memory

Secure, private multi-tenant execution spanning processors, memory, and accelerators remains one of the most significant challenges in modern edge computing systems. Simultaneously, processing-in-memory PIM has emerged as an effective approach for reducing the Von Neumann bottleneck by moving...

Beyond Source: An Empirical Study of Python Bytecode Security Risks

Python package security is largely source-centric, yet Python runtimes can execute bytecode directly through .pyc files, compiled-only modules, and marshalled code objects, creating an inspection-execution gap. We present an empirical study of Python bytecode as a security artifact. We measure...

Weird Machines in Transport Layer Security

Weird machines are latent computational capabilities that emerge from the composition of architectural components. Prior work has studied this phenomenon extensively in software systems, including x86 instructions, ELF metadata, and page tables, and more recently in cyber-physical systems such as...

Botan C++ Crypto Algorithms Library 3.13.0

Botan is a C++ library of cryptographic algorithms, including AES, DES, SHA-1, RSA, DSA, Diffie-Hellman, and many others. It also supports X.509 certificates and CRLs, and PKCS 10 certificate requests, and has a high level filter/pipe message processing system. The library is easily portable to...

Concept Drift Detection and Adaptive Retraining of Malware Classification Models

Concept drift refers to changes over time in the statistical properties of data, as compared to the data that was used to train a learning model. Machine learning models for malware detection or classification are particularly susceptible to performance degradation caused by concept drift, as...

Joern 4.0.603

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

CoSA: Context-Aware Severity Assessment Via Context Analysis with Large Language Models

Accurate vulnerability severity assessment is essential for prioritizing remediation, yet manually assessing Common Vulnerability Scoring System CVSS base metrics remains labor-intensive. Existing automated approaches often fail to capture the repository-level evidence required for assessing many...

Vaulted Passkeys: A Device-Bound Proposal for Authenticated Credential Export and Import

Hardware authenticators deliberately resist private-key extraction, yet replacement, disaster recovery, and controlled migration create a legitimate need for portability. Existing guidance for device-bound credentials commonly reduces recovery risk by registering an additional authenticator befor...

WordPress 7.0.2 Cross Site Scripting Checker

A vulnerability checker for a pre-authentication reflected cross site scripting vulnerability in WordPress version 7.0.2. The issue occurs in username handling on failed login attempts and can potentially be chained with administrator interaction and additional functionality to achieve code...

Microsoft Windows ICC File Parsing Remote Code Execution

Microsoft Windows contains a heap-based buffer overflow vulnerability related to the parsing of ICC color profiles that can allow an attacker to execute arbitrary code in the context of the current process. Insufficient validation of attacker-controlled data during ICC profile processing can resu...

OpenSSL Security Advisory 20260813

OpenSSL Security Advisory 20260813 - When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit...

Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents

The expanding operational capabilities of large language model LLM agents introduce sophisticated security threats. Runtime defenses have emerged as an effective approach to mitigating these risks by integrating security mechanisms into the agent execution loop. However, existing runtime defenses...

TopoIntent: Compiling Security Intent into Executable, Compliance-Checked Network Topologies

Enterprise security topology design requires translating business intent, regulatory requirements, and risk assumptions into zones, boundary devices, inter-zone paths, and access-control policies. Existing NetOps automation tools mainly operate after this design is fixed, providing limited suppor...

CodeQL 2.26.3

Discover vulnerabilities across a codebase with CodeQL, an industry-leading semantic code analysis engine. CodeQL lets you query code as though it were data. Write a query to find all variants of a vulnerability, eradicating it forever. Then share your query to help others do the same...

ATOBench: Tracing How Autonomous Penetration-Testing Agents Verify Vulnerabilities When Target Evidence Lies

Autonomous penetration-testing agents rely on target responses. These responses guide both subsequent actions and the final report. A deceptive response can therefore redirect both the attack trajectory and the agent's verification process. However, final reports reveal little about how an agent...

Sovereign by Necessity? Frontier AI Export Controls, Cyber Security, and the Limits of National AI Capability

A small number of firms based in two states produce the most capable frontier AI models. The governments of those states have shown both the legal power and the political will to decide which other countries may use these systems. In June 2026 the United States required a leading developer to...

Adversarial Robustness in Smishing Detection: A Comparative Analysis of Adversarial Fragility in Classical Vs. Transformer-Based Detection Systems

Smishing detection systems are commonly trained and evaluated on clean, monolingual text. In low-resource settings, however, attackers frequently circumvent these systems through character obfuscation, cross-lingual code-switching, and structural perturbation. This study evaluates adversarial...

LLM-Assisted Dynamic Threat Analysis for Attacker-Reachable Software Weaknesses in Autonomous Vehicles

Autonomous vehicles depend on large safety-critical software stacks, where weaknesses reachable from adversarial inputs may affect steering, braking, or other control decisions. Static analysis can identify candidate sites, but dynamically confirming exploitability requires executable test...

Labels Are Not Endpoints: Treatment Leakage and Construct Validity in MCP Agent Security Evaluation

Security evaluations of tool-using agents often equate stored labels with behavioral facts. We audit a preserved campaign by tracing 10,200 execution rows to 180 model-bound requests, 45 semantic requests, and 15 observable stimuli. Two schema treatments were delivered, but the planned external...

ROLoad-PMP: Securing Sensitive Operations for Kernels and Bare-Metal Firmware

A common way for attackers to compromise victim systems is hijacking sensitive operations e.g., control-flow transfers with attacker-controlled inputs. Existing solutions in general only protect parts of these targets and have high performance overheads, which are impractical and hard to deploy o...

Does Fixing Break Security? an Empirical Study of Security Degradation in Iterative LLM-Driven Infrastructure-As-Code Repair

Background: Iterative feedback loops are the dominant paradigm for improving LLM-generated Infrastructure-as-Code IaC: validators such as Checkov and terraform validate feed error signals back for successive repair attempts. Prior work reports cumulative-best metrics, which are non-decreasing by...

Wireshark Analyzer 4.6.8

Wireshark is a GTK+-based network protocol analyzer that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and Win32 and to give Wireshark features that are missing from closed-source sniffers. Thi...

CISA: K-12 Cybersecurity Foundations: Implementation Guide

The K-12 Cybersecurity Foundations: Implementation Guide is designed to help schools and districts improve their cyber posture and develop or sustain a reliable and sensible approach to cyber defense. It outlines eight objectives and actionable practices, strategies and tactics to support schools...

Rethinking Agent Security As a Networking Problem

AI agents are rapidly becoming more capable and widely deployed, promising substantial gains in productivity and enabling new classes of applications. However, their growing autonomy also introduces significant privacy and security risks. Existing defenses are predominantly agent-centric, relying...

CISA: K-12 Cybersecurity Foundations: Resource Package Overview

This one-pager provides an overview of the K-12 Cybersecurity Foundations Resource Package to help school and district leaders, IT and cybersecurity professionals, and other K-12 personnel navigate the resource package. It includes information on the resource package components and intended...

ToolHazard: Scaling Adversarial Environments for Security Evaluation and Alignment of LLM-Based Agents

Large language model LLM agents integrated with external tools are vulnerable to indirect prompt injections embedded in environmental states. However, existing studies largely rely on manually implemented or reused environments, stochastic LLM-based tool simulation, and predefined injection...

Slips: Behavioral Evidence Aggregation for Network Security

Network intrusion detection systems often analyze individual packets or flows, although malicious behavior may develop across many connections and over time. This may limit their ability to combine isolated detections into a coherent assessment of host behavior. Packet-level features may also be...

The Energetic Cost of Mitigating AI Attacks in Cellular Networks

The integration of Artificial Intelligence AI, generally as Machine Learning ML algorithms, in all levels and aspects of cellular networks demonstrates the success of data-driven algorithms; for example, the Radio Intelligence Controller RIC of the O-RAN paradigm bestows the network with optimise...

Black Hat USA 2024 Conference Slides

Black Hat USA 2024 conference slides for topics Self-Hosted GitHub CI/CD Runners: Continuous Integration, Continuous Destruction, From Weapon to Target: Quantum Computers Paradox, Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap, Windows Downdate: Downgrade Attacks Usin...

Black Hat Europe 2023 Conference Slides

Black Hat Europe 2023 conference slides for topics Unmasking APTs: An Automated Approach for Real-World Threat Attribution, How I Learned to Stop Worrying and Build a Modern Detection & Response Program, The Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread...

Black Hat USA 2023 Conference Slides

Black Hat USA 2023 conference slides for topics Does Public Disclosure of Vulnerabilities Affect Hacker Participation in Bug Bounty Programs?, Diversity Microtalks: Perspectives on Creating Change, ODDFuzz: Hunting Java Deserialization Gadget Chains via Structure-Aware Directed Greybox Fuzzing,...

Black Hat Europe 2024 Conference Slides

Black Hat Europe 2024 conference slides for topics Vulnerabilities in the eSIM download protocol, WiFi Calling: Revealing Downgrade Attacks and Not-so-private private Keys, From Pass-the-Hash to Code Execution on Schneider Electric M340 PLCs, CodeCloak: A DRL-Based Method for Mitigating Code...

Plaintext Recovery against Post-Filtering Access Control

Fine-grained access control FGAC mechanisms such as row-level security RLS and document-level security DLS are widely deployed in databases to restrict access to data stored in physical indexing structures shared by multiple users e.g., in multi-tenant databases, or in the implementation of...

VICBench: A Multi-Language Benchmark for Code Vulnerability Detection

Evaluating security vulnerability detection tools requires benchmark datasets with vulnerability-inducing commits VICs - the commits that first introduce vulnerabilities into codebases. VICs are essential for determining the full range of vulnerable software versions. Existing vulnerability...

REcon 2023 Conference Slides

REcon 2023 conference slides for topics Ice Ice Baby: Coppin' RAM With DIY Cryo-Mechanical Robot, Handoff All Your Privacy Again, Adventures of My Oven Pinocchio with ChipWhisperer, Enabling Security Research on Qualcomm Wifi Chips, The Hunt for Red October - One Ping Too Many, Cracking the Final...

CISA: K-12 Cybersecurity Foundations: Objectives and Practices

This one-pager provides an overview of the eight key objectives and associated practices found in the K-12 Cybersecurity Foundations: Implementation Guide. It serves as a quick reference guide for K-12 school and district leaders, IT and cybersecurity personnel, and other K-12 personnel involved ...

Towards Model-Based Run-Time Cybersecurity: On Control-Flow Anomaly Detection, Attack Identification, and Hardware Monitoring

Methods to increase the resilience of systems to cyber-attacks become increasingly important. Control-flow monitoring provides a principled basis to ensure integrity and detect possible anomalies at run-time. Once anomalies have been detected, so-called attack trees can be used to identify possib...

Machine Learning-Based Cyber Defense for Cloud Infrastructure: An Adaptive Deep Q-Network Architecture for Intelligent Intrusion Detection and Automated Threat Mitigation

With the increasing complexity of cyber assaults in cloud environments, adaptable security solutions are needed that can support real-time detection and autonomous response. In this paper, we propose a reinforcement learning-based dynamic cyber defense framework. We deploy a Deep Q-Network DQN to...

REcon 2024 Conference Slides

REcon 2024 conference slides for topics:JTAG Debug of Windows Hyper-V / Secure Kernel with WinDbg and DCI/EXDIPath of rev.ng-ance: From Raw Bytes to CodeQL on Decompiled CodeHypervisor-enforced Paging Translation - The End of Non Data-driven Kernel Exploits?Control Flow Intergrity on IBM iTips &...

A Comparison of Malware Image Transformations Using Grad-CAM and Hybrid Learning Models

Recent studies have shown that binary-to-image representations can enable effective machine learning-based results for malware detection and classification. However, performance can vary significantly, depending on the technique used to convert binaries to images. Furthermore, the explainability...

Dual-Layer Optical Security Framework for Cryptogram Camouflage Using Circular Harmonic Components

Protecting confidential information requires not only preventing unauthorized access to encrypted data but also concealing the very existence of the protected information. In this work, we propose a computational dual-layer optical security framework that integrates optical encryption and...

CISA: K-12 Cybersecurity Foundations: Getting Started Guide

The K-12 Cybersecurity Foundations: Getting Started Guide serves as a starting point for K-12 schools and districts and provides guidance on implementing fundamental cybersecurity controls, which are measures put in place to protect against and mitigate cyber threats...

OffensiveCon24 Conference Slides

OffensiveCon24 conference slides for topics Booting with Caution: Dissecting Secure Boot's Third-Party Attack Surface, UEFI and the Task of the Translator: Using Cross-Architecture UEFI Quines as a Framework for UEFI Exploit Development, The V8 Heap Sandbox, and Password Cracking: Past, Present,...

Black Hat Asia 2024 Conference Slides

Black Hat Asia 2024 conference slides for topics Confused Learning: Supply Chain Attacks through Machine Learning Models, The Fault in Our Metrics: Rethinking How We Measure Detection & Response, The Hack@DAC Story: Learnings from Organizing the World's Largest Hardware Hacking Competition, The...

OffensiveCon25 Conference Slides

OffensiveCon25 conference slides for topics Breaking the Sound Barrier: Exploiting CoreAudio via Mach Message Fuzzing, How Offensive Security Made Me Better at Defense, Finding and Exploiting 20-Year-Old Bugs in Web Browsers, and Entrysign: Create Your Own x86 Microcode for Fun and Profit...

Cross-Corpus Evaluation of Generalizable Vulnerability Detection in IoT Firmware

IoT firmware vulnerability detection remains challenging due to heterogeneous firmware ecosystems, resource-constrained platforms, and limitations in existing benchmarks. Many datasets are synthetic or general-purpose and lack human-verified, contamination-screened annotations, limiting evidence ...

Joern 4.0.601

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

The Next Challenge for Agentic Cybersecurity: A Realistic, Contamination-Free Reverse Engineering Benchmark

AI agents are rapidly improving in cybersecurity capabilities when the source code is available for analysis, yet much of the software most consequential to cybersecurity, including malware, firmware, and proprietary applications, is available only as binaries. Analyzing such software requires...

Benchmarking Cyberattack Detection in Electric Vehicle Charging Infrastructure with Benign User Updates

Cyberattack detection in electric vehicle charging infrastructure is complicated by legitimate post-activation revisions to requested energy and departure time. Charging manipulation attacks can exploit the same interface and variables; therefore, detecting a request change alone does not establi...